Security & VPN

VPNs: IPsec & DMVPN

Private networks over public transport: the IPsec framework — IKE negotiation, ESP encryption, tunnel and transport modes — and DMVPN, the hub-and-spoke overlay of mGRE and NHRP that lets branch offices build encrypted tunnels to each other on demand.

read in order, or dip in
2 chapters

read in order, or dip in

updated 31 Aug 2026
Free — no signup

updated 31 Aug 2026

Contents

  1. 01IPsec VPNs: IKE, ESP and the Two PhasesIPsec secures IP traffic with authentication and encryption negotiated in two phases: IKE first authenticates the peers and builds a protected control channel (the IKE SA), then negotiates the IPsec SAs — unidirectional agreements on algorithms and keys — under which ESP encrypts and authenticates the data. Tunnel mode wraps entire packets for site-to-site VPNs; IKEv2 with AES-GCM and strong DH groups is the modern baseline.
  2. 02DMVPN Explained: mGRE, NHRP and the Three PhasesDMVPN builds a hub-and-spoke VPN from one multipoint GRE interface per router, with NHRP resolving which public address hides behind each tunnel address — so new spokes join without any hub reconfiguration, and in phase 3 spokes build direct encrypted tunnels to each other on demand. It is the classic scalable branch WAN: mGRE for topology, NHRP for discovery, IPsec for protection, and a routing protocol over the top.

Spotted something out of date? Tell us — this library is maintained by the faculty.